EUVD-2026-48237
GHSA-995f-8qgf-h52p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Remote Development channel
-
DeliverySend crafted unauthorized input
-
ExploitBypass missing authentication check
-
ExecutionInject into remote session
-
ImpactCompromise backend workspace
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that IntelliJ IDEA's Remote Development feature is actively in use and that the attacker can reach the Remote Development session/backend over the network; the described 'unauthorized input injection' targets that specific session channel, and the CWE-306 missing-authentication root cause means no credentials are needed once the channel is reachable (consistent with PR:N/UI:N). The primary limiting factor is deployment: environments not using Remote Development are not exposed, and network segmentation that keeps the backend off untrusted networks sharply reduces reachability. Affected only on IntelliJ IDEA versions before 2026.2. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields the maximum 10.0: network-reachable, low complexity, no privileges, no user interaction, scope change, and full confidentiality/integrity/availability impact - an unusually severe profile consistent with the CWE-306 authentication-bypass tag. However, several corroborating signals are absent: no EPSS score, no KEV listing, no SSVC decision data, and no POC were provided, so real-world exploitation pressure cannot be quantified from this input. The score reflects theoretical maximum impact rather than confirmed widespread exploitation; the sparse one-line description ('unauthorized input injection ... in a Remote Development session') does not fully explain how S:C and full A:H are achieved, so the exact attack surface and impact chain should be verified against the JetBrains advisory. Practically, exposure is gated by whether Remote Development is actually in use and network-reachable, which materially narrows the realistic attack surface below what a bare 10.0 implies. |
| Exploit ScenarioDerived | An attacker who can reach a developer's Remote Development session over the network injects unauthorized input into the channel without supplying any credentials, because the critical function lacks authentication. Leveraging the scope-changing full-impact nature of the flaw, the injected input could manipulate the remote workspace's code or execution, effectively pivoting into the developer's backend host. No public exploit is currently identified, so this scenario is inferred from the CVSS vector and CWE-306 root cause. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to inject unauthorized input into an active Remote Development session, undermining the trust boundary between client and backend host. Because the flaw stems from missing authentication (CWE-306) on a Remote Development channel and carries a maximal CVSS 10.0 with scope change, a successful attacker can influence code, files, or execution on the remote workspace. There is no public exploit identified at time of analysis, but the ceiling severity warrants prompt patching.
RemediationAI
Vendor-released patch: 2026.2 - upgrade JetBrains IntelliJ IDEA to 2026.2 or later, which remediates the missing-authentication flaw in Remote Development; consult the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for build-specific guidance. Until the upgrade is applied, reduce exposure by disabling Remote Development where it is not required, and restrict network reachability of Remote Development backend hosts so their listening ports are accessible only over trusted networks or a VPN rather than the open internet; the trade-off is that legitimate remote developers must connect through the restricted path, which may interrupt existing remote workflows. Avoid exposing IDE backend endpoints directly to untrusted networks, and monitor Remote Development sessions for unexpected connections as a detection compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IntelliJ IDEA's Remote Development feature splits the IDE into a thin local client and a headless backend running on a remote host, communicating over a network channel to edit and execute code on the remote machine. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), meaning a security-critical operation on the Remote Development pathway did not properly verify the identity of the party supplying input. This lets 'unauthorized input injection' reach a session that should only accept input from the authenticated developer, and the vendor's own tag of 'Authentication Bypass' aligns with this root-cause class. No CPE strings were supplied in the intelligence, so exact affected component enumeration relies on the vendor's version statement ('before 2026.2').
Know when Intellij Idea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable Remote Development channel with missing authentication (PR:N) and no user interaction; injection into the remote backend crosses a trust boundary (S:C) with full impact.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
Executive ViewAI
JetBrains IntelliJ IDEA Remote Development contains a critical authentication bypass vulnerability (CVE-2026-64812, CVSS 10.0) enabling remote attackers to inject unauthorized commands into active development sessions, compromising code integrity and intellectual property across development teams. No patch is currently available, requiring immediate network controls to prevent attacker access to source repositories and build systems.
Disable JetBrains IntelliJ IDEA Remote Development feature until vendor patch available; if operationally required, implement strict network segmentation with firewall rules restricting Remote Development server access to internal-only connections via IP whitelisting, implement session logging and real-time monitoring for unauthorized code or file modifications, and enforce multi-factor authentication for all local development workstations as secondary controls.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Intellij Idea
View allUnauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration with
Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper
Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by con
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin
In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. Rated
In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartex
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to s
In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote att
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin,
JetBrains Toolbox App and IntelliJ IDEA expose a certificate-validation weakness in the jetbrainsd daemon that can let a
Command execution in JetBrains IntelliJ IDEA before 2026.1.1 allows a holder of the low-privileged guest user account to
Unauthorized file access in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to read files they should not
Exploit-DB